Home / server / Questions / 557308
In Process
yar
Asked: 2013-11-26 09:05:33 +0800 CST

Does Postfix need a TLS cert for every destination domain?

  • 772

When Postfix is the destination for multiple domains, does it need a TLS cert for every one of them, or just for the domain in $myhostname?

That is to say, are there smtp clients out there who will check certs against the MX they used to look us up, or are they all smart enough to wait for 220 response and/or do reverse DNS, and check against that?

Is it even possible to receive the 220 without checking the certificate first?

But otherwise, is it even possible for Postfix to know what cert the client wants?

EDIT: Even if they do reverse DNS, if clients are willing to accept MX addresses that resolve to arbitrary domains, isn't that trivial to MITM? Or is the solution to never use a vanity MX if I want TLS?

postfix

1 Answers

  1. For my money, the way to do this is to avoid vanity MX. It's close to meaningless, anyway - how many actual people ever get to see your MX record? Vanity domains are fine, but TLS will be simpler if you have the MX record in all cases be the CN embedded in the certificate.

    • 1